Ofcom has now issued two separate fines this year against pornography websites for failing to carry out "highly effective" age checks under the UK’s Online Safety Act — and the pattern emerging from both cases is a useful early warning for anyone building a business around adult content in the UK, OnlyFans creators included.
On 8 September 2026, the regulator confirmed a £730,000 penalty against the operator of xgroovy.com: £700,000 for failing to deploy effective age-verification technology between July and November 2025, plus a further £30,000 for ignoring one of Ofcom’s legally binding information requests. A £200-a-day penalty now applies until the site hands over the outstanding information Ofcom asked for, or by 3 November 2026, whichever comes first. It follows an earlier confirmation decision, announced 24 August 2026, fining the operator behind Fapello.com £600,000 for the same category of failure, plus £30,000 for non-compliance with an information request — bringing the combined enforcement total across the two cases to more than £1.3 million.
What Ofcom actually found
In both cases, the regulator’s complaint wasn’t that the sites hosted adult content — that’s legal — but that neither had "highly effective age assurance" in place during the period under investigation, as required under Section 12 of the Online Safety Act. Fapello had reportedly introduced some age-checking measures at one point and then withdrawn them. Ofcom’s Director of Enforcement, George Lusty, put the regulator’s position plainly: companies must introduce effective age checks to prevent children from accessing pornography, and those that fail to comply — or ignore legally binding information requests — face financial penalties.
Notably, Ofcom also rejected the idea that geo-blocking UK IP addresses alone is enough to end the exposure. Fapello blocked UK traffic in January 2026, but Ofcom found the site "remains in scope" of the Act because UK users could still reach it through a VPN. That’s a meaningful precedent: a simple IP block isn’t being treated as a compliance fix on its own.
Why this matters even though OnlyFans isn’t the target
OnlyFans itself already runs age verification at sign-up and has done for some time, so this isn’t a story about OnlyFans facing enforcement. But the direction of travel matters for anyone earning through the platform:
- Your own website or link-in-bio page is in scope too. If you run a personal site, a linktree-style hub, or a preview/teaser page that shows adult content to UK visitors, Section 12 duties can apply to you directly as the service provider, not just to OnlyFans as the platform.
- Promotional and preview content on other platforms carries risk. Ofcom and other regulators have been increasingly focused on the free, unverified spaces — Twitter/X, Reddit, Telegram — where creators post teaser content to drive subscriptions. A page that serves that content to UK users without any age assurance is the exact profile Ofcom has now fined twice.
- Geo-blocking the UK is not a guaranteed exit from enforcement. If you or an agency you work with operates a site outside OnlyFans and assumes blocking UK IPs solves the problem, the Fapello decision suggests Ofcom disagrees.
- The daily penalty structure shows Ofcom’s enforcement is getting more aggressive, not less. Both cases involved add-on fines for ignoring information requests, and both carry ongoing daily penalties — this isn’t a one-off slap on the wrist, it’s a sustained compliance process.
What to actually check
- If you run any site or page of your own that displays adult previews or content to UK visitors, confirm it has a genuine age-verification step — not just a "click to confirm you’re 18" button, which does not meet the "highly effective" standard Ofcom is enforcing.
- If an agency manages a promotional site or linkhub for you, ask them directly what age-assurance method it uses and whether it’s been reviewed since the Online Safety Act’s adult-content duties came into force in July 2025.
- Don’t rely on geo-blocking alone as your compliance answer for any site you control — Ofcom has now explicitly said it isn’t sufficient by itself.
- Keep a record of what age-assurance measures are in place and when they were implemented — Ofcom’s fines in both cases were increased specifically for failing to respond to information requests, not just for the underlying age-check failure.
This article is for general information and isn’t legal advice. If you’re unsure whether the Online Safety Act’s duties apply to a site or service you operate, speak to a solicitor with UK online safety or media law experience.
Part of a wider pattern
These fines land alongside a broader run of age-verification enforcement this year, from the EU’s December 2026 age-verification app deadline to Australia’s decision to fine porn sites up to $49.5 million a breach, which pushed one major operator to geo-block the country entirely rather than comply — the same operator, Aylo, whose approach Ofcom’s Fapello decision suggests UK regulators won’t accept as a substitute for actual age checks. It’s also worth reading alongside our coverage of the UK’s new screenshotting and nudification offences and the FCA’s rules on banks debanking sex workers — together they paint a picture of UK regulators across several different remits all tightening enforcement around adult content and the people who create it, in different ways, in the same year.
